-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| postgraas-server | pip | < 2.0.0 | 2.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe SQL query construction in create_postgres_db. The commit diff shows the fix transitioned from string interpolation to using psycopg2's SQL composition utilities (SQL() and Identifier()), which properly escape parameters. The vulnerability report specifically identifies this function, and the patch directly addresses SQL injection in database/user creation logic. The high-risk pattern of building SQL with .format() and direct variable interpolation matches classic SQL injection vectors.
Ongoing coverage of React2Shell